@dupecom/botcha-cloudflare 0.2.0 → 0.3.0

package/dist/routes/stream.js

@@ -0,0 +1,242 @@
+/**
+ * BOTCHA SSE Streaming Challenge Endpoint
+ *
+ * Server-Sent Events (SSE) based interactive challenge flow
+ */
+import { Hono } from 'hono';
+import { stream as honoStream } from 'hono/streaming';
+import { generateToken } from '../auth';
+import { sha256First } from '../crypto';
+const app = new Hono();
+// ============ HELPER FUNCTIONS ============
+/**
+ * Format SSE event
+ */
+function formatSSE(event, data) {
+    return `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+}
+/**
+ * Store session in KV
+ */
+async function storeSession(kv, session) {
+    const ttlSeconds = Math.ceil((session.expiresAt - Date.now()) / 1000);
+    await kv.put(`stream:${session.id}`, JSON.stringify(session), { expirationTtl: Math.max(ttlSeconds, 60) });
+}
+/**
+ * Get session from KV
+ */
+async function getSession(kv, id) {
+    const data = await kv.get(`stream:${id}`);
+    return data ? JSON.parse(data) : null;
+}
+/**
+ * Delete session from KV
+ */
+async function deleteSession(kv, id) {
+    await kv.delete(`stream:${id}`);
+}
+/**
+ * Generate unique session ID
+ */
+function generateSessionId() {
+    return `sess_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+}
+// ============ ROUTES ============
+/**
+ * GET /v1/challenge/stream
+ *
+ * Opens an SSE connection and sends challenge instructions in sequence
+ */
+app.get('/v1/challenge/stream', async (c) => {
+    const sessionId = generateSessionId();
+    const version = c.env.BOTCHA_VERSION || '0.3.0';
+    // Create session
+    const session = {
+        id: sessionId,
+        status: 'waiting',
+        createdAt: Date.now(),
+        expiresAt: Date.now() + 5 * 60 * 1000, // 5 minutes
+    };
+    await storeSession(c.env.CHALLENGES, session);
+    return honoStream(c, async (stream) => {
+        // Send welcome event
+        await stream.write(formatSSE('welcome', {
+            session: sessionId,
+            version,
+        }));
+        // Send instructions in sequence
+        await stream.write(formatSSE('instructions', {
+            message: 'I will test if you\'re an AI agent.',
+        }));
+        await stream.sleep(100);
+        await stream.write(formatSSE('instructions', {
+            message: 'When you send "GO", I\'ll start a speed challenge.',
+        }));
+        await stream.sleep(100);
+        await stream.write(formatSSE('instructions', {
+            message: 'You must solve 5 SHA256 problems in under 500ms.',
+        }));
+        await stream.sleep(100);
+        await stream.write(formatSSE('instructions', {
+            message: 'Only real AI agents can pass. Humans are too slow.',
+        }));
+        await stream.sleep(100);
+        // Send ready event
+        await stream.write(formatSSE('ready', {
+            message: 'Send GO when ready',
+            endpoint: `/v1/challenge/stream/${sessionId}`,
+        }));
+        // Update session status
+        session.status = 'ready';
+        await storeSession(c.env.CHALLENGES, session);
+        // Keep connection alive (SSE standard practice)
+        // In production, this would be handled by connection timeout
+        // For now, we'll keep it open for 5 minutes
+        const keepAliveInterval = 15000; // 15 seconds
+        const maxWait = 5 * 60 * 1000; // 5 minutes
+        const startTime = Date.now();
+        while (Date.now() - startTime < maxWait) {
+            await stream.sleep(keepAliveInterval);
+            // Send heartbeat comment (SSE standard)
+            await stream.write(': heartbeat\n\n');
+            // Check if session was updated (challenge started)
+            const updatedSession = await getSession(c.env.CHALLENGES, sessionId);
+            if (!updatedSession || updatedSession.status !== 'ready') {
+                break;
+            }
+        }
+    });
+});
+/**
+ * POST /v1/challenge/stream/:session
+ *
+ * Handle actions: "go" (start challenge) or "solve" (submit answers)
+ */
+app.post('/v1/challenge/stream/:session', async (c) => {
+    const sessionId = c.req.param('session');
+    const body = await c.req.json();
+    const { action, answers } = body;
+    // Validate session
+    const session = await getSession(c.env.CHALLENGES, sessionId);
+    if (!session) {
+        return c.json({
+            success: false,
+            error: 'SESSION_NOT_FOUND',
+            message: 'Session not found or expired',
+        }, 404);
+    }
+    // Handle "go" action - start challenge
+    if (action === 'go') {
+        if (session.status !== 'ready') {
+            return c.json({
+                success: false,
+                error: 'INVALID_STATE',
+                message: `Session is in ${session.status} state, expected ready`,
+            }, 400);
+        }
+        // Generate challenge problems
+        const problems = [];
+        const expectedAnswers = [];
+        for (let i = 0; i < 5; i++) {
+            const num = Math.floor(Math.random() * 900000) + 100000;
+            problems.push({ num, operation: 'sha256_first8' });
+            expectedAnswers.push(await sha256First(num.toString(), 8));
+        }
+        // Update session
+        session.status = 'challenged';
+        session.problems = problems;
+        session.expectedAnswers = expectedAnswers;
+        session.timerStart = Date.now();
+        await storeSession(c.env.CHALLENGES, session);
+        // Return challenge event
+        return c.json({
+            success: true,
+            event: 'challenge',
+            data: {
+                problems,
+                timeLimit: 500,
+                instructions: 'Compute SHA256 of each number, return first 8 hex chars',
+            },
+        });
+    }
+    // Handle "solve" action - verify answers
+    if (action === 'solve') {
+        if (session.status !== 'challenged') {
+            return c.json({
+                success: false,
+                error: 'INVALID_STATE',
+                message: `Session is in ${session.status} state, expected challenged`,
+            }, 400);
+        }
+        if (!answers || !Array.isArray(answers)) {
+            return c.json({
+                success: false,
+                error: 'MISSING_ANSWERS',
+                message: 'Missing answers array',
+            }, 400);
+        }
+        const now = Date.now();
+        const solveTimeMs = now - (session.timerStart || now);
+        // Delete session to prevent replay
+        await deleteSession(c.env.CHALLENGES, sessionId);
+        // Check timing
+        if (solveTimeMs > 500) {
+            return c.json({
+                success: false,
+                event: 'result',
+                data: {
+                    success: false,
+                    verdict: '🚫 TOO SLOW',
+                    message: `Took ${solveTimeMs}ms, limit was 500ms`,
+                    solveTimeMs,
+                },
+            });
+        }
+        // Check answers
+        if (answers.length !== 5) {
+            return c.json({
+                success: false,
+                event: 'result',
+                data: {
+                    success: false,
+                    verdict: '❌ WRONG FORMAT',
+                    message: 'Must provide exactly 5 answers',
+                },
+            });
+        }
+        for (let i = 0; i < 5; i++) {
+            if (answers[i]?.toLowerCase() !== session.expectedAnswers[i]) {
+                return c.json({
+                    success: false,
+                    event: 'result',
+                    data: {
+                        success: false,
+                        verdict: '❌ WRONG ANSWER',
+                        message: `Wrong answer for problem ${i + 1}`,
+                    },
+                });
+            }
+        }
+        // Success! Generate JWT token
+        const token = await generateToken(sessionId, solveTimeMs, c.env.JWT_SECRET);
+        return c.json({
+            success: true,
+            event: 'result',
+            data: {
+                success: true,
+                verdict: '🤖 VERIFIED',
+                message: `Challenge passed in ${solveTimeMs}ms! You are a bot.`,
+                solveTimeMs,
+                token,
+                expiresIn: '1h',
+            },
+        });
+    }
+    // Unknown action
+    return c.json({
+        success: false,
+        error: 'UNKNOWN_ACTION',
+        message: `Unknown action: ${action}. Expected "go" or "solve"`,
+    }, 400);
+});
+export default app;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dupecom/botcha-cloudflare",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "BOTCHA for Cloudflare Workers - Prove you're a bot. Humans need not apply.",
   "type": "module",
   "main": "dist/index.js",
@@ -16,10 +16,10 @@
     "README.md"
   ],
   "scripts": {
-    "dev": "wrangler dev",
+    "dev": "bun run scripts/dev-intro.ts",
     "deploy": "wrangler deploy",
     "build": "tsc",
-    "prepublishOnly": "npm run build",
+    "prepublishOnly": "bun run build",
     "test": "vitest"
   },
   "keywords": [
@@ -36,7 +36,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/i8ramin/botcha"
+    "url": "https://github.com/dupe-com/botcha"
   },
   "homepage": "https://botcha.ai",
   "dependencies": {
@@ -46,7 +46,7 @@
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250124.0",
     "typescript": "^5.9.3",
-    "wrangler": "^4.5.0",
+    "wrangler": "^4.63.0",
     "vitest": "^3.0.0"
   }
 }